tim
a00c1b4c9d
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
106 lines
3.1 KiB
PHP
106 lines
3.1 KiB
PHP
<?
|
|
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
|
|
|
|
if (isset($_SERVER['HTTPS'])) {
|
|
session_cache_limiter('private');
|
|
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
session_start();
|
|
|
|
if (isset($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} elseif (check_persistent_login()) {
|
|
// check_persistent_login() sets $_SESSION['editor']
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
}
|
|
|
|
function check_persistent_login() {
|
|
if (!array_key_exists('PersistentAuth', $_COOKIE)) {
|
|
return false;
|
|
}
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
|
|
list($username, $key) = explode("|", $cookie_data);
|
|
$username = $db->real_escape_string($username);
|
|
$key = $db->real_escape_string($key);
|
|
|
|
$query = "SELECT * FROM $table WHERE ".
|
|
"username LIKE '".$username."' ".
|
|
"LIMIT 1;";
|
|
$getid = $db->query($query) or die("Query failed: ".$db->error());
|
|
$row = $getid->fetch_assoc();
|
|
open_db('close');
|
|
|
|
if (isset($row)) {
|
|
// Set up session, and delete old cookie, and create new persistent cookie
|
|
$stored_session = $row['session'];
|
|
if ($stored_session == $key) {
|
|
// login
|
|
$_SESSION['editor'] = $username;
|
|
// delete cookie
|
|
delete_persistent_login();
|
|
// create new cookie
|
|
create_persistent_login($username);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function create_persistent_login($username) {
|
|
$validity = strtotime('+1 year'); // Time to keep the session valid
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$username = $db->real_escape_string($username);
|
|
$key = substr(bin2hex(mcrypt_create_iv(100,MCRYPT_DEV_URANDOM)), 0, 200);
|
|
|
|
// Add session key to database
|
|
$query = "INSERT INTO $table " . "(username, session) VALUES ('" . $username."', '" . $key . "');";
|
|
$db->query($query) or die("Query failed: ".$db->error());
|
|
open_db('close');
|
|
|
|
// Create cookie with key
|
|
setcookie('PersistentAuth', "$username|$key", $validity, '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|
|
|
|
function delete_persistent_login() {
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
|
|
list($username, $key) = explode("|", $cookie_data);
|
|
$username = $db->real_escape_string($username);
|
|
$key = $db->real_escape_string($key);
|
|
|
|
// Add session key to database
|
|
$query = "DELETE FROM $table " .
|
|
" WHERE username LIKE '" . $username . "'" .
|
|
" AND session LIKE '" . $key . "';";
|
|
$db->query($query) or die("Query failed: ".$db->error());
|
|
|
|
// Reap old sessions
|
|
$query = "DELETE FROM $table " .
|
|
" WHERE created < DATE_SUB(now(), INTERVAL 1 YEAR);";
|
|
$db->query($query) or die("Query failed: ".$db->error());
|
|
|
|
open_db('close');
|
|
|
|
// Delete cookie
|
|
setcookie("PersistentAuth", false, strtotime('-1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|